Exception Risk Calculator

Exception risk = (0.30 × control criticality + 0.25 × data sensitivity + 0.20 × window band + 0.15 × blast-radius band + 0.10 × internet exposure) × compensating factor × renewal uplift. Time is treated as a risk factor in its own right, because the same technical gap is a different exposure for thirty days than for three years. Compensating controls reduce the score by at most 60%, and each previous renewal adds an uplift — a permanent exception is not an exception, it is an undocumented change to the policy, and the arithmetic should make that visible.

Exception registers are where security debt accumulates quietly, and mapping a score to a named approver and a maximum window is what stops a temporary bypass becoming the architecture. These are management estimates to support consistent decisions, not a compliance determination.

This calculator takes 8 inputs: Criticality of the control being bypassed, Requested exception window, Sensitivity of the data or system in scope, Compensating control strength, Systems or endpoints covered by the exception, Any affected system is internet-facing, Times this exception has already been renewed, Strength of the business justification. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

The control comes back on by default and the exception has to be re-argued with fresh evidence. Exceptions that lapse into silent permanence are the ones that appear in incident reports, and automatic expiry is the only mechanism that reliably prevents it.

No, and capping its benefit at 60% is deliberate. A compensating control was designed for a different purpose, is rarely tested against this specific risk, and often shares a dependency with the control being bypassed.